Guide
Security
Authentication, isolation, keys, and audit.
Step 1. Authentication
Clerk handles user and organization authentication. Pam Pod routes require a valid session.
Step 2. Pam Pod isolation
Supabase RLS enforces Pam Pod boundaries on all tenant data. Cross-Pam Pod access is denied at the database layer.
Step 3. Audit events
Security-sensitive actions append to the audit log. API keys are hashed and never returned after creation.